CVE-2023-53136 (GCVE-0-2023-53136)

Vulnerability from cvelistv5 – Published: 2025-05-02 15:56 – Updated: 2026-05-11 19:39
VLAI
Title
af_unix: fix struct pid leaks in OOB support
Summary
In the Linux kernel, the following vulnerability has been resolved: af_unix: fix struct pid leaks in OOB support syzbot reported struct pid leak [1]. Issue is that queue_oob() calls maybe_add_creds() which potentially holds a reference on a pid. But skb->destructor is not set (either directly or by calling unix_scm_to_skb()) This means that subsequent kfree_skb() or consume_skb() would leak this reference. In this fix, I chose to fully support scm even for the OOB message. [1] BUG: memory leak unreferenced object 0xffff8881053e7f80 (size 128): comm "syz-executor242", pid 5066, jiffies 4294946079 (age 13.220s) hex dump (first 32 bytes): 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ backtrace: [<ffffffff812ae26a>] alloc_pid+0x6a/0x560 kernel/pid.c:180 [<ffffffff812718df>] copy_process+0x169f/0x26c0 kernel/fork.c:2285 [<ffffffff81272b37>] kernel_clone+0xf7/0x610 kernel/fork.c:2684 [<ffffffff812730cc>] __do_sys_clone+0x7c/0xb0 kernel/fork.c:2825 [<ffffffff849ad699>] do_syscall_x64 arch/x86/entry/common.c:50 [inline] [<ffffffff849ad699>] do_syscall_64+0x39/0xb0 arch/x86/entry/common.c:80 [<ffffffff84a0008b>] entry_SYSCALL_64_after_hwframe+0x63/0xcd
Severity
7.1 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: 314001f0bf927015e459c9d387d62a231fe93af3 , < f3969427fb06a2c3cd6efd7faab63505cfa76e76 (git)
Affected: 314001f0bf927015e459c9d387d62a231fe93af3 , < ac1968ac399205fda9ee3b18f7de7416cb3a5d0d (git)
Affected: 314001f0bf927015e459c9d387d62a231fe93af3 , < a59d6306263c38e5c0592ea4451ca26a0778c947 (git)
Affected: 314001f0bf927015e459c9d387d62a231fe93af3 , < 2aab4b96900272885bc157f8b236abf1cdc02e08 (git)
Create a notification for this product.
Linux Linux Affected: 5.15
Unaffected: 0 , < 5.15 (semver)
Unaffected: 5.15.103 , ≤ 5.15.* (semver)
Unaffected: 6.1.20 , ≤ 6.1.* (semver)
Unaffected: 6.2.7 , ≤ 6.2.* (semver)
Unaffected: 6.3 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/unix/af_unix.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "f3969427fb06a2c3cd6efd7faab63505cfa76e76",
              "status": "affected",
              "version": "314001f0bf927015e459c9d387d62a231fe93af3",
              "versionType": "git"
            },
            {
              "lessThan": "ac1968ac399205fda9ee3b18f7de7416cb3a5d0d",
              "status": "affected",
              "version": "314001f0bf927015e459c9d387d62a231fe93af3",
              "versionType": "git"
            },
            {
              "lessThan": "a59d6306263c38e5c0592ea4451ca26a0778c947",
              "status": "affected",
              "version": "314001f0bf927015e459c9d387d62a231fe93af3",
              "versionType": "git"
            },
            {
              "lessThan": "2aab4b96900272885bc157f8b236abf1cdc02e08",
              "status": "affected",
              "version": "314001f0bf927015e459c9d387d62a231fe93af3",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/unix/af_unix.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.15"
            },
            {
              "lessThan": "5.15",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.103",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.20",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.2.*",
              "status": "unaffected",
              "version": "6.2.7",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.3",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.103",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.20",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.2.7",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.3",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\naf_unix: fix struct pid leaks in OOB support\n\nsyzbot reported struct pid leak [1].\n\nIssue is that queue_oob() calls maybe_add_creds() which potentially\nholds a reference on a pid.\n\nBut skb-\u003edestructor is not set (either directly or by calling\nunix_scm_to_skb())\n\nThis means that subsequent kfree_skb() or consume_skb() would leak\nthis reference.\n\nIn this fix, I chose to fully support scm even for the OOB message.\n\n[1]\nBUG: memory leak\nunreferenced object 0xffff8881053e7f80 (size 128):\ncomm \"syz-executor242\", pid 5066, jiffies 4294946079 (age 13.220s)\nhex dump (first 32 bytes):\n01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................\n00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................\nbacktrace:\n[\u003cffffffff812ae26a\u003e] alloc_pid+0x6a/0x560 kernel/pid.c:180\n[\u003cffffffff812718df\u003e] copy_process+0x169f/0x26c0 kernel/fork.c:2285\n[\u003cffffffff81272b37\u003e] kernel_clone+0xf7/0x610 kernel/fork.c:2684\n[\u003cffffffff812730cc\u003e] __do_sys_clone+0x7c/0xb0 kernel/fork.c:2825\n[\u003cffffffff849ad699\u003e] do_syscall_x64 arch/x86/entry/common.c:50 [inline]\n[\u003cffffffff849ad699\u003e] do_syscall_64+0x39/0xb0 arch/x86/entry/common.c:80\n[\u003cffffffff84a0008b\u003e] entry_SYSCALL_64_after_hwframe+0x63/0xcd"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T19:39:09.687Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/f3969427fb06a2c3cd6efd7faab63505cfa76e76"
        },
        {
          "url": "https://git.kernel.org/stable/c/ac1968ac399205fda9ee3b18f7de7416cb3a5d0d"
        },
        {
          "url": "https://git.kernel.org/stable/c/a59d6306263c38e5c0592ea4451ca26a0778c947"
        },
        {
          "url": "https://git.kernel.org/stable/c/2aab4b96900272885bc157f8b236abf1cdc02e08"
        }
      ],
      "title": "af_unix: fix struct pid leaks in OOB support",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2023-53136",
    "datePublished": "2025-05-02T15:56:08.940Z",
    "dateReserved": "2025-05-02T15:51:43.561Z",
    "dateUpdated": "2026-05-11T19:39:09.687Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2023-53136",
      "date": "2026-07-25",
      "epss": "0.00168",
      "percentile": "0.06383"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2023-53136\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-05-02T16:15:32.540\",\"lastModified\":\"2026-06-17T06:44:21.880\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\naf_unix: fix struct pid leaks in OOB support\\n\\nsyzbot reported struct pid leak [1].\\n\\nIssue is that queue_oob() calls maybe_add_creds() which potentially\\nholds a reference on a pid.\\n\\nBut skb-\u003edestructor is not set (either directly or by calling\\nunix_scm_to_skb())\\n\\nThis means that subsequent kfree_skb() or consume_skb() would leak\\nthis reference.\\n\\nIn this fix, I chose to fully support scm even for the OOB message.\\n\\n[1]\\nBUG: memory leak\\nunreferenced object 0xffff8881053e7f80 (size 128):\\ncomm \\\"syz-executor242\\\", pid 5066, jiffies 4294946079 (age 13.220s)\\nhex dump (first 32 bytes):\\n01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................\\n00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................\\nbacktrace:\\n[\u003cffffffff812ae26a\u003e] alloc_pid+0x6a/0x560 kernel/pid.c:180\\n[\u003cffffffff812718df\u003e] copy_process+0x169f/0x26c0 kernel/fork.c:2285\\n[\u003cffffffff81272b37\u003e] kernel_clone+0xf7/0x610 kernel/fork.c:2684\\n[\u003cffffffff812730cc\u003e] __do_sys_clone+0x7c/0xb0 kernel/fork.c:2825\\n[\u003cffffffff849ad699\u003e] do_syscall_x64 arch/x86/entry/common.c:50 [inline]\\n[\u003cffffffff849ad699\u003e] do_syscall_64+0x39/0xb0 arch/x86/entry/common.c:80\\n[\u003cffffffff84a0008b\u003e] entry_SYSCALL_64_after_hwframe+0x63/0xcd\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: af_unix: se corrigen fugas de struct pid en la compatibilidad OOB. syzbot report\u00f3 una fuga de struct pid [1]. El problema radica en que queue_oob() llama a perhaps_add_creds(), que potencialmente contiene una referencia a un PID. Sin embargo, skb-\u0026gt;destructor no est\u00e1 definido (ni directamente ni mediante la llamada a unix_scm_to_skb()). Esto significa que las posteriores operaciones kfree_skb() o consume_skb() filtrar\u00edan esta referencia. En esta correcci\u00f3n, opt\u00e9 por ofrecer compatibilidad total con scm, incluso para el mensaje OOB. [1] ERROR: p\u00e9rdida de memoria, objeto no referenciado 0xffff8881053e7f80 (tama\u00f1o 128): comunicaci\u00f3n \\\"syz-executor242\\\", pid 5066, jiffies 4294946079 (edad 13.220s), volcado hexadecimal (primeros 32 bytes): 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ backtrace: [] alloc_pid+0x6a/0x560 kernel/pid.c:180 [] copy_process+0x169f/0x26c0 kernel/fork.c:2285 [] kernel_clone+0xf7/0x610 kernel/fork.c:2684 [] __do_sys_clone+0x7c/0xb0 kernel/fork.c:2825 [] do_syscall_x64 arch/x86/entry/common.c:50 [inline] [] do_syscall_64+0x39/0xb0 arch/x86/entry/common.c:80 [] entry_SYSCALL_64_after_hwframe+0x63/0xcd \"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"net/unix/af_unix.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"314001f0bf927015e459c9d387d62a231fe93af3\",\"lessThan\":\"f3969427fb06a2c3cd6efd7faab63505cfa76e76\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"314001f0bf927015e459c9d387d62a231fe93af3\",\"lessThan\":\"ac1968ac399205fda9ee3b18f7de7416cb3a5d0d\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"314001f0bf927015e459c9d387d62a231fe93af3\",\"lessThan\":\"a59d6306263c38e5c0592ea4451ca26a0778c947\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"314001f0bf927015e459c9d387d62a231fe93af3\",\"lessThan\":\"2aab4b96900272885bc157f8b236abf1cdc02e08\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"net/unix/af_unix.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"5.15\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"5.15\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.103\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.20\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.2.7\",\"lessThanOrEqual\":\"6.2.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.3\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H\",\"baseScore\":7.1,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.2}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-125\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.15\",\"versionEndExcluding\":\"5.15.103\",\"matchCriteriaId\":\"C0E85B4E-2E2E-4207-B03B-3C136EFE774D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.16\",\"versionEndExcluding\":\"6.1.20\",\"matchCriteriaId\":\"B22D8949-72A1-4CED-8318-A040635DEEBE\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.2\",\"versionEndExcluding\":\"6.2.7\",\"matchCriteriaId\":\"EFEDDF17-189C-4901-BD6B-41752E80AAA4\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.3:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"B8E3B0E8-FA27-4305-87BB-AF6C25B160CB\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/2aab4b96900272885bc157f8b236abf1cdc02e08\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/a59d6306263c38e5c0592ea4451ca26a0778c947\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/ac1968ac399205fda9ee3b18f7de7416cb3a5d0d\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/f3969427fb06a2c3cd6efd7faab63505cfa76e76\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-06-29T22:10:00+00:00",
      "cve": "CVE-2023-53136",
      "id": "CVE-2023-53136",
      "initial_release_date": "2023-01-01T00:00:00+00:00",
      "product_status:known_affected": "42",
      "product_status:known_not_affected": "232",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: af_unix: fix struct pid leaks in OOB support",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2023/cve-2023-53136.json",
      "version": "3"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.